Description

SteveOgh

opened on Jan 22, 2020

Issue body actions

Looking for method(s) to hide the password portion of the for demos and scripts.

Activity

1. pesse commented on Jan 22, 2020

   

   pesse

   on Jan 22, 2020

   Member

   More actions

   Hi @SteveOgh ,
   thanks opening an issue.

   What you can do is to write your password to an environment variable and use it in your call:

   Linux/Unix:

   export PW=myPassword
   utplsql run user/$PW@myConnectstring
   

   Windows:

   $env:PW="myPassword"
   utplsql run user/$env:PW@myConnectstring
   

   That way it is not shown and - as far as I know - not written to the command history.

   It might still be useful to have another option. What comes to my mind:

   1. Get user, password and connectstring from (predefined, fixed) environment variables when they are not provided
   2. Prompt for password if it's not set

   I prefer 1 over 2, because prompting might break automated setups and it's also harder to implement.
2. simonuwe commented on Jan 5, 2022

   

   simonuwe

   on Jan 5, 2022

   More actions

   In linux using an environment-variable in/as a commandline parameter does not really hide the value (only in shell history).
   It is possible for every user on the system to see the password while the utplsql is running with
   ps -ef

   Example
   `
   export PW=xx; sh -c "sleep 1; echo $PW"& ps -ef | grep echo
   [2] 1881476
   uwe 1881476 1312384 0 11:07 pts/2 00:00:00 sh -c sleep 1; echo xx
   uwe 1881478 1312384 0 11:07 pts/2 00:00:00 grep --color=auto echo

   `
3. gassenmj commented on Aug 1, 2023

   

   gassenmj

   on Aug 1, 2023

   More actions

   Hi there,

   i am commenting this issue - hope it is okay to track it here:
   Let's say i run something like:

   sh ./utPLSQL-cli/bin/utplsql run -c -q schema-tst/super-secure-pwd@tns-string

   Can i hide the password at least from the DEBUG output?
   In version 3.1.9 i always get the password printed like:

   14:37:26.505 [main] DEBUG org.utplsql.cli.Cli - Args: run, -c, -q, schema-tst/super-secure-pwd@tns-string

   EDIT 7-AUG-2023: It is possible by placing a logback.xml file in the lib folder with the following content:

   <configuration>
   
     <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
       <encoder>
         <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
       </encoder>
     </appender>
     <root level="info">
       <appender-ref ref="STDOUT" />
     </root>
   
   </configuration>
   

   Reading a bit about Logback it says that Logback scans the classpath for such an .xml. In my case i had to create a ./etc directory:

   >tree -D
   [Aug  7 20:43]  .
   ├── [Aug  7 20:43]  bin
   │   ├── [Aug  7 20:42]  utplsql
   │   └── [Jun 13  2022]  utplsql.bat
   ├── [Aug  7 20:43]  etc
   │   └── [Aug  7 20:39]  logback.xml
   └── [Aug  7 20:42]  lib
       ├── [Jun 13  2022]  cli-3.1.9.jar
       ├── [Jun 13  2022]  java-api-3.1.9.jar
       ├── [Jun 13  2022]  javax.activation-api-1.2.0.jar
       ├── [Jun 13  2022]  jaxb-api-2.3.1.jar
       ├── [Jun 13  2022]  jsr305-3.0.2.jar
       ├── [Jun 13  2022]  logback-classic-1.2.11.jar
       ├── [Jun 13  2022]  logback-core-1.2.11.jar
       ├── [Jun 13  2022]  ojdbc8-19.3.0.0.jar
       ├── [Jun 13  2022]  ons-19.3.0.0.jar
       ├── [Jun 13  2022]  oraclepki-19.3.0.0.jar
       ├── [Jun 13  2022]  orai18n-19.3.0.0.jar
       ├── [Jun 13  2022]  osdt_cert-19.3.0.0.jar
       ├── [Jun 13  2022]  osdt_core-19.3.0.0.jar
       ├── [Jun 13  2022]  picocli-4.6.3.jar
       ├── [Jun 13  2022]  simplefan-19.3.0.0.jar
       └── [Jun 13  2022]  slf4j-api-1.7.36.jar
   

   I did find my classpath by adding an echo $CLASSPATH in ./bin/utplsql

   imho it still makes sense to change the logging level in the code to TRACE

   Reacted by Max Satula
4. simasch

   self-assigned this

   on Aug 2, 2023
5. jgebal

   assigned

   jgebal

   and unassigned

   simasch

   on Apr 27, 2026
6. jgebal commented on Sep 27, 2026

   

   jgebal

   on Sep 27, 2026

   Member

   More actions

   Hi,
   With the upcoming changes the following issues are addressed:

   • username and password is never shown in logs (including debug mode)
   • connections via oracle wallet are supported so no credentials need to be passed to utPLSQL-cli at all

   There is no plan currently to implement a solution to allow cli to use some specific environment variables to read user/password directly from shell instead of using parameters.

   There will be probably a support for json or yaml config file to handle configuration via file instead of relying strictly on command line. That could help also with managing and hiding passwords.

   Therefore PR #232 closes this issue
7. jgebal

   closed this as completedin #232on Sep 27, 2026

Issue actions